GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
From October 2023 to December 2024, Deutsche Bahn Fernverkehr AG, the national railway company of Germany (controller), offered certain low-cost tickets ('Sparpreis' and 'Super Sparpreis') exclusively in digital form. To purchase these tickets—via app, telephone, or at the counter—data subjects were required to provide either an email address or a mobile phone number to receive a digital ticket or order number. The purchase was not possible via the ticket machines. A consumer protection organisation filed a claim before the Higher Regional Court Frankfurt (OLG Frankfurt am Main), requesting a cease and desist order, arguing that the controller processed personal data without a valid legal basis. The court held that the controller violated Article 5(1)(a) GDPR for processing personal data without a valid legal basis by requiring data subjects to provide an email address or mobile phone number in order to purchase the discounted tickets. First, it found that the controller failed to obtain freely given consent under Article 6(1)(a) GDPR since it did not offer an equivalent alternative for purchasing the ticket without providing personal data. Therefore, data subjects were not able to make a genuine and free choice, and therefore the consent could not be considered valid. The court referred to judgment [https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 C-252/21 ECJ] in which it confirmed that consent is invalid when it is tied to the performance of a service without an alternative. The court also highlighted that the controller held a dominant market position in long-distance rail transport in Germany. This market power reinforced the lack of voluntariness in the purported consent, as data subjects had no reasonable alternative to using the controller’s services. Second, the court held that the data processing is not justified under Article 6(1)(b) GDPR, processing of contract data. It held th
The data subject was a tenant in an apartment owned by the controller. Termination proceedings were pending between the parties. During those proceedings, the data subject submitted photos and documents suggesting that the controller had been monitoring them. They subsequently submitted an access request, seeking access to personal data processed about them, including among other things, information concerning their heating and hot-water consumption. The controller refused to provide the requested information. The data subject claimed that the refusal had left them with a feeling of powerlessness, stress and uncertainty about the extent to which their private activities had been monitored and their personal data processed. They therefore filed a claim for damages. The controller argued that the data subject’s access request was an abusive exercise of rights because it had been submitted in the context of the termination proceedings. It claimed that their sole intention was to obtain evidence for that dispute. It alleged that the data subject had not shown any interest in this information prior to the court proceedings. The controller also argued that the requested information was protected as its trade secrets. It further requested that the proceedings in this case be stayed until the termination proceedings and the proceedings pending before the Austrian DPA had been finally resolved. The first-instance court rejected the motion for a stay and upheld the data subject’s claims. It found that the access request was not abusive, as the data subject pursued legitimate purposes under Recital 63. It held that the data subject sought to obtain information about the data concerning them and verifying the lawfulness of that processing. It further held that trade secrets could override the right of access only in special circumstances and that the controller’s purpose to avoid giving the data subject an advantage in the termination proceedings was not sufficient. The contro
The data subject requested access to personal data processed in the Fraud Signalling System (FSV), including the reason for inclusion, the municipality that requested his data, and whether he had received fraud codes. The FSV was a tool employed by the Dutch Tax and Customs Administration to monitor potential tax fraud by analysing citizens' personal data. The Minister (the controller) granted partial access to the FSV data, but rejected access to certain fraud codes, as they related to a third party’s data. The Minister also explained the reason for the data subject’s inclusion in the FSV, including the municipality’s request. The data subject argued that the response was insufficient and requested further details, including the exact date of inclusion in the FSV, the names of officials involved, and access to more systems. The controller provided the name of the municipality that made the request, but did not provide the names of employees involved or screenshots of the search in the FSV. The data subject contested the controller's decision, and brought the case to the Central Netherlands District Court. The court found that the controller had provided sufficient access to the data subject’s personal data in the FSV. There was no obligation to provide additional data or screenshots of the search. The court ruled that the controller was correct in not providing the names of employees or third-party personal data, as the data subject's request for access to other applications, systems, and correspondence was deemed outside the scope of the original access request. The case was dismissed, but the controller was ordered to pay €500 compensation for the delay in its response, but no additional data or documents were required to be provided to the data subject.
In 2022, the data subject, a partner in an auditing and consulting firm, entered into a phone contract with a telecommunications company (controller). The data subject received the contractual terms and conditions, as well as the data protection information sheet. The contract included a clause that authorized the transmission of personal data to credit information agencies for the protection of the controller's legitimate interests or those of third parties. The data subject was also informed of their rights under the GDPR, including the right to withdraw consent. Subsequently, the controller transferred data about the conclusion of the telecommunications contract to a credit information agency (CRIF GmbH). The data subject brought a case to the District Court of Nürnberg and requested €1,500 in damages from the controller and demanded it stops unlawfully processing the data subject’s data. The controller rejected the claim, arguing that the data processing was necessary and based on contractual agreements. The court dismissed the data subject’s action for the following reasons: Regarding damages The court found no basis for the damages claim under Article 82 GDPR . The data subject admitted that no tangible damage could be concretely identified. Referencing case law by the CJEU, the court held that the mere assertion of fear about potential consequences is insufficient to justify compensation under Article 82 GDPR. Regarding the lawfulness According to the court, the data subject had consented to the disclosure of his personal data to the credit information agency when the contract was concluded by agreeing to the provisions in the data protection information sheet . The consent was also necessary for the controller to protect its legitimate interests, and the data subject had been informed of this upon entering into the contract. Consent, in accordance with Article 7 GDPR, was therefore validly given. Furthermore, there was no evidence that the cons
The data subject is a renowned lawyer specialised in employment law and the controller a university operating as a corporation under public law. In 2020, the data subject was sentenced for fraud by a court of first instance (Regional Court of Munich I). In 2022 the Federal Court of Justice overturned this judgment. In June 2021, the controller advertised a temporary position for a lawyer, to which the data subject applied for, enclosing all relevant documents, and then went through the interview process. In July 2021, the data subject received a rejection notice from the controller, stating that it can be seen from publicly available online sources that the data subject had been sentenced for fraud by the court of first instance. Even though the judgement is not yet legally binding, he could only be hired under the resolutory condition of a clean criminal record. He was also informed that another candidate, who matched the requirements better, had been selected. In December 2022, the data subject filed a case with the Court of First Instance (Düsseldorf Labor Court -ArbG Düsseldorf) claiming, amongst other things, that he is entitled to material and immaterial damages due to the unlawful collection of his personal data. The core of the allegations is that that the controller collected the data from the internet without him being aware, the collected data was incorrect and since the controller did not inform him about the processing he was not given the opportunity to comment which had an influence to the outcome of the selection process. The controller claimed that the position had been filled with another applicant who demonstrated better professional competence in comparison to the data subject. The knowledge of the criminal proceedings against the data subject and their evaluation in relation to the position were additional reasons for the rejection. The data subject is not entitled to damages under Article 82(1) GDPR, because the personal data collection d
The social media platform was accused of tracking users through embedded Business Tools without consent, violating cookie consent requirements.
Austria’s main postal service is the controller for the case. In addition to providing postal services, the controller is also licensed as an “address publisher" and "direct marketing company”. The controller collected data about Austrian residents (the data subjects) without their consent. In particular, the controller used certain socio-demographic circumstances (e.g. age, place of residence, level of education) for profiling. The profiling consisted in an estimation of the likelihood that a data subject fell within certains categories (e.g. "do-it-yourselfer", "night owl", "person with affinity for investments"). One of the data subjects claimed that the controller processed his data unlawfully and sought immaterial damages for €7,000 under Article 82 GDPR. The courts of first and second instance both denied his claim. In particular, the Court of Appeal held that the data subject failed to prove the occurrence of immaterial damage. It is worth noting that the controller did not disclose the subject’s data. The controller also deleted the data at the request of the data subject, following a 2021 Supreme Court ruling between the same parties. The Court upheld the previous findings of the Court of Appeal and denied compensation. In the Court’s view, the data subject showed failed to prove that he suffered him anxiety or annoyance as a result of the processing of his data. On these grounds, the Court concluded that non-material damages were not proven and could not be compensated. The Court did not assess whether the subject's data were processed lawfully, as he would not have been able to claim damages either way.
The data subjects submitted a request to the Municipality of Almere (the controller), under Article 15 GDPR, seeking access to their personal data contained in their adult son's 'Social Support file'. In May 2019, the controller provided partial access, refusing to provide access to the extent necessary for the protection of third-parties, their son. The data subjects challenged the decision of the controller before the court of first instance (District Court of Midden), alleging that the controller withheld additional personal data. The lower court partly agreed, finding that more data should have been disclosed, but upheld the decision on the extent that data concerning third parties should not be disclosed. The data subjects appealed the decision before the the Council of State, claiming that it is up to them and not the controller or the court to judge whether the confidentiality and the right to privacy of others makes an intrusion into the lives of their families permissible. They also sought damages for exceeding the reasonable time limit to a fair and public hearing. The Council of State upheld the controller’s decision to withhold access to the data subjects' personal data where disclosure would have infringed the privacy of their adult son. It confirmed that in the event of a conflict between the full exercise of the right of access under Article 15 GDPR and the rights or freedoms of others, it is up to the controller to weigh them against each other. In this case the controller adequately justified the balancing of interests. Additionally, it found that the total duration of the proceedings, exceeding the reasonable period of four years by two years and two months, violated the reasonable time requirement under [https://fra.europa.eu/de/law-reference/european-convention-human-rights-article-6 Article 6 ECHR]. The court awarded €2,500 in damages, split among the Ministry of Justice, the Ministry of the Interior, and the controller.
The controller operated a website offering paid and free trial software solutions. The data subject used the controller’s services. The controller stored only the data subject’s email address. On 30 September 2020, unknown third parties accessed the controller’s systems and obtained personal data of users, among it email addresses, usernames, names, addresses and telephone numbers. The attackers later made the data available online for free. The data subject claimed that their email address was affected by the incident. On 7 June 2023, the data subject submitted an access request under Article 15 GDPR and asserted further claims. The controller replied on 14 August 2023. The data subject argued that the controller had failed to ensure adequate security of processing and had therefore infringed the GDPR, in particular by not implementing sufficient technical and organisational measures within the meaning of Article 32 GDPR. They further alleged that the controller had not designated a representative in the European Union and had unlawfully transferred data outside the European Economic Area. They claimed that these infringements caused them discomfort and emotional distress. The data subject sought at least €3,000 in non-material damages under Article 82(1) GDPR for the data breach and at least €2,000 for an allegedly insufficient response to his Article 15 GDPR request. They also sought a declaration of liability for future material damage and an injunction requiring the controller to refrain from making personal data accessible to unauthorised third parties without state-of-the-art security measures. First, the court rejected the request for a declaration of liability for future damage, as it found no sufficient probability of future damage. The data subject had not demonstrated that they had suffered fraudulent contact attempts attributable to the breach. The court also noted that a previous, unrelated data breach had already affected the same email address. As
The controller managed a social media platform (Facebook) that the data subject had an account on. In 2019, the platform experienced a data breach via their Contact Import Tool (CIT) that affected the personal data of the data subject, specifically the phone number. The data breach was only noticed in 2021, after which the data subject asked the controller directly to pay €500 in non-material damages due to the loss of control over their data and exposure to scams sent to their contact details. The data subject also demanded the controller desist from sharing their personal data to third parties in the future, and included an (Article 15) right of access request. The controller denied paying damages and held that they provided an adequate amount of data protection measures. This resulted in the previous court decision, in which the court held that non-material damages (Article 82) can be caused by losing control over personal data and begin with the illegal scraping, and not just when the illegal processing of the scraped data starts. Furthermore, these damages don't necessitate the existence of further emotional pain or financial damages. It also considered that the CIT is not covered under Article 6(1)(b) because it is not necessary for the fulfillment of a contract. It awarded the data subject €250 in non-material damages. That decision was appealed by the controller. The high court argued that there could have been no non-material damages because the scraped data only contained the phone number and gender of the data subject, but not their first or last name. It acknowledges that the interpretation of damages should be kept broad in reference to Recital 146 and that there is no need for a specific severity or significance, but insists that a breach of data protection law itself does not necessarily constitute non-material damages. Data subjects should still have to prove that there have actually been causal consequences to the data breach and that a loss of c
Genetic testing company Asper Biogene (the controller) was targeted by a cyberattack from September 26 to November 10 2023. The attackers exfiltrated data for about 10,000 data subjects from 22 EU Member States, including genetic data. The DPA investigated the incident and found that the controller did not implement sufficient security measures. In particular, the controller allowed weak passwords, used weak encryption for passwords, and did not implement multi-factor authentication. The DPA found a breach of Article 32 GDPR and issued a €80,000 fine. In the same investigation, the DPA found that the controller’s DPO was the sole member of the Board of Directors and that he formally appointed himself for the role. Furthermore, he lacked the data protection expertise required for the role. The DPA fined the controller €5,000 for violating Articles 37(5) and 38(6) GDPR. The controller challenged the decision. The Court annulled the DPA's decision. With regards to the violation of Article 32, the Court held that the controller could not be sanctioned based on the procedural rules in effect at the time of the violation. Specifically, Article 14 of the Criminal Code (now repealed) only allowed companies to be prosecuted for GDPR violations that were committed by a specific individual on behalf of the company. With regards to the appointment of the DPO, the Court confirmed the violation but considered the fine to be disproportionate and annulled it. In this regard the Court considered, among other factors, that the controller had since appointed a new DPO, that the proceedings were sufficient punishment for the controller, and that there was no public interest in the proceedings. The Court also held that the infringement was minor in nature.
Sociálna poisťovňa, the social insurance agency (the controller), processes applications for foreign invalidity pensions and forwards related documents to the social insurance institutions of other EU Member States. A data subject applied for a Danish invalidity pension. On 22 October 2018, the controller sent the data subject's sensitive personal data (including health data, personal identification number and a Danish personal identifier) to the Danish social insurance institution by ordinary (uninsured, untracked) second-class mail rather than by registered mail. The data subject could not confirm delivery and, in November 2018, filed a request with the Slovak DPA alleging that sending sensitive data by ordinary mail, without any proof of dispatch or protection against loss, violated their data protection rights. The controller resent the documents by the same method in December 2018. The DPA's first-instance decision (13 June 2019) found that the controller had violated Article 24(1) in conjunction with Article 32(1) and (2) GDPR, because sending sensitive personal data by ordinary rather than registered mail did not ensure a level of security appropriate to the risk. The DPA ordered the controller to use registered mail for such dispatches going forward and imposed a fine of €50,000. The controller's appeal was rejected, and the Slovak DPA president upheld the first-instance decision. The controller then brought an action before the Regional Administrative Court Bratislava, arguing among other things that: the parcel had in fact been delivered (as confirmed by the Danish institution by email), registered mail offers no greater protection against loss of confidentiality than ordinary mail, only one data subject was concerned and no damage had occurred and the decision's operative part improperly referred to the data of pension applicants generally, not just the individual data subject who had filed the complaint. The court did not rule on the substance of the s
The Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband – vzbv) brought an action against ImmobilienScout24 GmbH, the operator of an online real estate platform in Germany. The controller offered users a “self-disclosure form” to fill out before contacting landlords. This form collected extensive personal data, such as name, address, employment details, and income. Some fields were marked as mandatory. The website also promoted credit reports by a German credit information agency (i.e. SCHUFA), stating that landlords increasingly required them before apartment viewings. The vzbv claimed that this practice violated the GDPR because the data were collected without a valid legal basis. It further argued that the SCHUFA advertising was misleading under the German Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb – UWG), as it falsely suggested that tenants were obliged to provide credit reports at an early stage. Accordingly, vzbv requested two injunctions to stop the processing of personal data in connection with the self-disclosure form and to prohibit misleading advertising about SCHUFA credit reports. The Regional Court of Berlin (Landgericht Berlin – LG Berlin) upheld both claims. It found that the controller’s data processing violated Article 5(1)(a) in conjunction with Article 6(1) GDPR, and that its advertising breached the UWG. The Court held that the controller had no valid legal basis for collecting data via the self-disclosure form. There was no valid consent according to Article 6(1)(a) GDPR, as filling out the form could not be considered voluntary and unambiguous and the processing lacked a specific purpose. Many fields were mandatory and the purpose of processing was only vaguely described. The court also found that the processing was not necessary for pre-contractual measures under Article 6(1)(b) GDPR, as it was not indispensable to initiate rental negotiations. Similarly, the Court rejected that there was a le
A natural person (the controller) installed CCTV cameras on his property. Aside from his own property, the cameras covered a part of the property of a neighbour (the data subject) as well as the public road. The data subject filed a complaint with the DPA to challenge the recording of his property. The DPA held that the controller had no legal basis for recording the data subject’s property and the public road. On these grounds, it issued an injunction against the controller to stop the unlawful processing (by dismantling the cameras or restricting their field of view) or, as an alternative, to suspend the recording and later provide DPA with a written assessment of his legitimate interest to process personal data (Article 6(1)(f) GDPR). The controller unsuccessfully challenged the decision with the Tallinn Administrative Court and later escalated the case to the Tallinn District Court. The District Court of Tallinn dismissed the controller’s challenge. = The DPA and the lower court both held that the case at hand did not fall under the household exemption of Article 2(2)(c) GDPR. In this regard, the DPA and the lower court referred to Ryneš, a pre-GDPR era ruling of the CJEU. According to Ryneš, the household exemption (then found under Article 3(2) of the now-repealed Data Protection DirectiveDirective 95/46/EC (available [https://eur-lex.europa.eu/eli/dir/1995/46/oj/eng here]).) does not apply to CCTV surveillance when the cameras also cover public space. On the other hand, the controller held that the household exemption applied to his case and that the Ryneš ruling was irrelevant because it applied Article 3(2) of the Data Protection Directive rather than 2(2)(c) GDPR. The Tallinn District Court upheld the previous findings: the household exemption did not apply to the case for the reasons clarified in Ryneš, i.e. the cameras covered public ground. The Court also clarified that Ryneš was still relevant to the case at hand because Article 2(2)(c) GDPR does no
The data subject has been an employee of the controller since 1 February 2015. In April 2023, the controller was informed of several allegations against the data subject, claiming that the subject created a toxic work environment. To verify the claims, the controller began an internal investigation from 25 August 2023 until 11 January 2024. The final investigation report contained all allegations and the personal data of witnesses and accusers. The data subject claimed the investigation was biased and not objective, and that the resulting report has been used to justify disciplinary measures, rejections of part time work requests, and an attempted termination, and has been quoted in interviews with the press. To understand what has been said about them and verify how truthful the investigation was and if their data was processed lawfully, the data subject requested a copy of the investigation report, if necessary with redacted personal information, based on Article 15(1) and (3) GDPR. The data subject also argued that disclosure of the compliance report was not barred by the rights of the controller or third parties. They maintained that the defendant had no legitimate confidentiality interest, that economic interests were insufficient, and that the report did not qualify as a trade secret or be protected by whistleblower protections, as any third-party concerns could be addressed through redaction or anonymization. Also, the data subject claimed a statutory right of access to the report as part of her personnel file based on § 83(1) BetrVG and § 26 (2) SprAuG, arguing that secret personnel files are impermissible. Finally, the data subject argued that immediate enforceability should be possible, as no disadvantage would result and any confidentiality interests of other individuals had already been undermined by the controller quoting the report in court proceedings. Following that, the data subject requested to either get a copy of the investigation report, or
The National School of Judiciary and Public Prosecutor (also known as KSSiP, the controller) notified the DPA regarding a data breach in April 2020. The national police notified the controller of the appearance of personal data on the internet related to the controller’s website domain. The data breach involved the access to a copy of the controller’s training site database created during a test migration to a new training platform. This led to the disclosure of personal data of over 50,000 people whose data was collected on the training platform, including judges, prosecutors and law clerks. Following an investigation, the DPA fined the controller PLN 100,000 (€22,000) for failing to implement appropriate technical and organisational measures. According to the DPA, the controller had not properly taken the risks of processing into account, as it did not carry out an impact assessment on the effectiveness of the measures. Furthermore, the controller had not fulfilled several obligations as a controller. For example, the controller had not verified whether its instructions were being complied with by the company hired to carry out the database migration (the processor). In its decision, the DPA stated that the controller violated Articles 5(1)(f), Article 24(1), Article 25(1), 28(3), Article 32(1) and Article 32(2) GDPR. The DPA decided not to fine the processor, as it had complied with its obligations under the GDPR; here, the DPA stated that the data breach occurred as a result of the actions taken by the controller. The controller appealed the case to the Administrative Court, who upheld the reasoning of the DPA in August 2022. The controller later appealed the case to the Supreme Administrative Court. The controller argued that it had implemented sufficient technical and organisational measures, and that the Administrative Court had not had not fully assessed the factual circumstances of the case and had applied the GDPR erroneously by placing all of the resp
The controller, a credit information agency, made two entries in its register regarding past default payments by the data subject from 2019 and 2021, in the amounts of €201 and €100, both of which were settled on 03.08.2023 and 07.05.2024. On 9 July and 9 August 2024, the data subject requested the deletion of the data and correction of her score but the controller refused. The data subject filed a case before the court of first instance (Regional Court of Regensburg-LG Regensburg) requesting the deletion of the entry, correction of the score value and injunctive measures against renewed storage by the controller. The court of first instance rejected her claims under Article 16 and Article 17 GDPR, holding that the controller’s interests outweighed the data subject’s, according to Article 6(1))f GDPR, and that there was no unlawful processing. Also, the data subject could not demand the complete deletion due to an alleged lack of necessity. The data subject appealed against this judgment before the court of appeal (Higher Regional Court of Nuremberg-OLG Nürnberg). She argued in particular that the court of first instance misjudged the allocation of the burden of proof, because the burden of proof for the existence of a legitimate interest in data processing lies with the controller and that the controller had not convincingly argued the necessity of storing the data for three years after the claims had been settled, invoking ECJ jurisprudence[https://curia.europa.eu/juris/liste.jsf?language=de&num=C-26/22 C-26/22], C-64/22, and [https://curia.europa.eu/juris/document/document.jsf?text=&docid=280623&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 C-340/21] . The controller claimed that it had legitimate interest under Article 6(1)(f) GDPR, and referred to industry standards permitting a three-year retention. The Higher Regional Court of Nuremberg issued its preliminary legal view of the case (Hinweisbeschlüssen). First, the court of appeal held th
A data subject made an access request to a bank (controller) regarding log data concerning him and in particular the identity of the employees who processed his customer data between 1 November and 31 December 2013, the purpose of the processing and the dates on which the data were accessed. The data subject filed a complaint with the DPA requesting access to this data. In August 2020, the DPA dismissed his complaint stating that no order for access to the data will be issued because the log data in question do not constitute data concerning the data subject but they relate specifically to the employees who have processed the customer data. The data subject appealed this decision to the court of first instance (Administrative Court of Eastern Finland). In September 2021, the court of first instance requested a preliminary ruling from the CJEU asking if the right of access of the data subject under Article 15(1) GDPR is to be interpreted so that it includes information collected by the controller which shows who, when and for what purpose he has processed the data subject's personal data, in particular when it concerns data relating to the controller's employees. In June 2023 the CJEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=274867&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 Case C-579/21]) held, inter alia, that Article 15(1) GDDPR must be interpreted as meaning that the information relating to the times and purposes of the searching of a person's personal data constitutes information that a data subject is entitled to obtain from the controller under that provision. By contrast, that provision does not establish such a right to information concerning the identity of the employees of the controller who have carried out the searches under the authority and on the instructions of the controller, except where that information is necessary to enable the data subject to exercise effectively the rights conferred on him by the GDPR and
In 2022, the data subject was notified that since 2014 he was registered in the Fraud Signaling Facility (Fraudesignaleringsvoorziening – FSV), a database used by the Dutch Tax and Customs Administration to register indications of fraud. The FSV did not comply with the GDPR and therefore since 2020 was no longer in use. The Minister of Finance investigated the incident on its own initiative and found that data subject's data had the not been shared with other agencies, the registration did not negatively impact the data subject and therefore he was not eligible for compensation. In November 2023, the data subject submitted an access request under Article 15 GDPR for his personal data stored in the FSV to the Minister. The Minister granted this request with a ministerial decision and provided an overview of his registration. The data subject disagreed with this ministerial decision and filed an objection claiming that the record provided was incomplete. Then the Minister provided additional data. The data subject filed an appeal against the ministerial decision on objection before the North Holland District Court (HAA) maintaining that the data remained incomplete. Furthermore, the data subject claimed that the FSV registration had long-term harmful effects on his reputation and business due to unlawful sharing with third parties and led to negative decisions by other agencies. Lastly, he seeked €25,000 in non-material damages. First, the court found no evidence that the data subject’s FSV data had been shared with other authorities. The negative decisions from other agencies were received before his registration in 2014. Second, the court also stated it was not competent to award damages in this case. According to national procedural law, only a civil court could assess claims for damages stemming from factual acts of the public administration, like data sharing, as the administrative court can only assess damages directly linked to unlawful decisions. Th
The DPA’s fine Spotify (the data controller) provided customers (the data subjects) with an online function to download their data directly from the controller’s online platform. This download function was meant to provide data subjects with a response to their access requests. In 2019 three complaints were filed in Austria, the Netherlands, and Denmark. The complainants used the controller’s download function and claimed that they did not receive clear and complete information. The data subject who filed a complaint in Austria was represented by noyb. In response to the complaints, the DPA launched an ex officio investigation on Spotify’s handling of access requests from customers. In 2023, after years of inactivity and an interlocutory ruling from the Stockholm administrative courtThis ruling was purely procedural. It is not to be confused with the ruling of June 2024 from the same court, which reviewed the DPA’s decision and lowered the fine. For more information on the interlocutory ruling and the procedural background of the case, see the comment., the DPA finally issued a decision as the lead supervisory authority. The decision was adopted according to the GDPR’s cooperation procedure and addressed both the complaints and the broader findings of the DPA’s investigation. With regards to the controller’s general practices for handling access requests, the DPA found systematic violations of the right of access. Some of the information in the controller’s responses was incomplete, while other information was complete but unclear, as it was provided in the form of technical log files and without a sufficiently clear explanationThe Court upheld the DPA's reasoning on this point. For more details, please refer to the summary for the DPA's decision.. On these grounds, the DPA held that the controller violated violating Articles 15(1)(a)-(d) and (g), 15(2), and 12(1) GDPR. The DPA issued a 58,000,000 SEK (approximately €5,000,000) fine. With regards to the complaints,